From 6c3176b32c108e1263e8c5f5300a9c05d646fc76 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Tue, 1 Sep 2020 23:36:17 +0100 Subject: [PATCH] Linux: Improve lengths for name_as_str --- .../framework/symbols/linux/extensions/__init__.py | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/volatility/framework/symbols/linux/extensions/__init__.py b/volatility/framework/symbols/linux/extensions/__init__.py index 5ad79a22a..f2f18c4d0 100644 --- a/volatility/framework/symbols/linux/extensions/__init__.py +++ b/volatility/framework/symbols/linux/extensions/__init__.py @@ -9,14 +9,15 @@ from typing import Generator, Iterable, Iterator, Optional, Tuple from volatility.framework import constants from volatility.framework import exceptions, objects, interfaces, symbols from volatility.framework.layers import linear -from volatility.framework.symbols import generic, linux from volatility.framework.objects import utility +from volatility.framework.symbols import generic, linux from volatility.framework.symbols import intermed from volatility.framework.symbols.linux import extensions from volatility.framework.symbols.linux.extensions import elf vollog = logging.getLogger(__name__) + # Keep these in a basic module, to prevent import cycles when symbol providers require them @@ -154,10 +155,10 @@ class module(generic.GenericIntelProcess): @property def section_strtab(self): - #Newer kernels + # Newer kernels if self.has_member("kallsyms"): return self.kallsyms.strtab - #Older kernels + # Older kernels elif self.has_member("strtab"): strtab = self.strtab @@ -363,13 +364,13 @@ class qstr(objects.StructType): def name_as_str(self) -> str: if self.has_member("len"): - str_length = self.len + str_length = self.len + 1 # Maximum length should include null terminator else: str_length = 255 try: ret = objects.utility.pointer_to_string(self.name, str_length) - except exceptions.InvalidAddressException: + except (exceptions.InvalidAddressException, ValueError): ret = "" return ret